How risky are you? Do you arrive an hour early at the airport or end up running like mad to your departure gate? Do you buy your partner’s gift on Christmas Eve or find out what they want in October? Do you eat yoghurt past its sell by date?

In your personal life, your appetite to risk is ultimately your decision. But in the professional environment, minimising risk is always the name of the game - or is it?

Because there’s increasingly an understanding that while risk is a scary word, simply avoiding risk is impossible, especially within multi-academy trusts.

“A trust has many more things to consider than a school did under maintained or local-authority control,” says Tom Meeks, a partner at Price Bailey which works with trusts on risk strategy.

He cites areas like IT, HR and estates as areas where trusts have to understand and manage numerous risks they face - something that requires the creation of a risk register.

This document essentially lists all of the various risks an organisation faces - cyber attacks, lack of business continuity, fire, reputational damage and so on - and then scores them in terms of likelihood and impact.

An appetite for risk

This is something many firms have and numerous templates exist to guide this process. However, while this is an important document, it can often lack nuance - something Ele Lewis, director of strategy at Lift Schools, knows firsthand.

“When I joined, one task was to update our risk register - it was quite an unwieldy beast and very complicated and there was no clear way of knowing ‘are we okay with this [risk]’?”

She says most of the things were simply scored yellow - indicating moderate risk - and there was no clear insight on the trust’s approach to this: which was an area where risk was tolerated, or where it was a concern? Where could a school innovate?

The need to find answers to these sorts of questions is not unique to education - within the corporate world, it has long been understood that quantifying risk is vital.

“Organisations have to take some risks and avoid others. To do so, they need to be clear about what successful performance looks like,” explains the Institute of Risk Management.

Doing this requires the creation of a risk appetite statement which, essentially, helps codify how risky, or not, an organisation is willing to be in a given area to help inform its strategy.

Selecting your risk levels

While not ubiquitous within education, Meeks says it’s growing in awareness: “If we took a snapshot across our client base in 2024 compared to 2014 there would be an absolute chasm of difference in terms of awareness and sophistication of risk management.”

One trust that has been on this journey is Astrea Academy Trust, where assistant CEO Tomas Thurogood-Hyde, led the creation of its first risk appetite statement, published in April 2024.

“We were returning every so often to the question of what’s our appetite for that risk? And how do we feel about that risk? So our risk appetite statement had the purpose of helping us understand where we were open to taking more risk,” he explains.

The document shows clearly how the trust has grouped its risk appetite into five areas:

• Opposed: avoidance of risk and uncertainty is key objective.
• Minimalist: preference for safe options that have a low degree of inherent risk.
• Cautious: preference for safe options that have a low degree of residual risk.
• Moderate: willing to consider all options and choose one that is most likely to result in successful delivery.
• Innovative: eager to be innovative and to choose options that suspend previously held assumptions and accept greater uncertainty.

Then, under this, 14 different areas of focus are listed against these criteria. Some such as safeguarding and financial controls are listed as being “opposed” to risk - as you may imagine. However, in areas such as reputation, a “moderate” stance is taken, as the document outlines:

“The trust is willing to entertain reputational risk where this is a consequence of delivering educational improvements, positioning itself as an employer of choice, or where it is necessary to ensure financial sustainability and efficiency.”

Meanwhile at Lift, Lewis’s work also moved beyond redrafting the risk register and onto creating a risk appetite statement - although with slightly different terminology: avoid, minimal, cautious, open, seek, mature.

Taking the idea to trustees

Of course, though, while creating the terms to use is one thing, the big challenge is deciding which risk appetite you have for each area - something Meek says must come under the CEO’s oversight, but be co-created by key leaders across the trust.

“We advise clients to have an appropriate forum to discuss risk at an executive level. That may be a headteachers’ group, or the heads of IT, estates and HR coming together to discuss risk and what they think the appetite should be,” he says.

Doing this means the trust leaders can then come together and consider where they wish to place each area - before sharing it with trustees to “review, appraise and challenge,” he adds - a key moment because “the appetite for risk is very much the responsibility of the trustees”.

Thurogood-Hyde concurs that asking trustees to agree to taking risks when they have legal responsibilities for a trust, can be a challenge.

“One of the interesting conversations we had was saying, ‘can we really say we’re pro any sort of risk?’. Or that we’re anything other than opposed to reputational risk, to people risk…we don’t want a statement that says, ‘we take risks with our people’.”

This issue speaks to one reason why trustee boards are becoming increasingly professional - you need people who understand things like risk appetite statements from their backgrounds.

“We had one particular trustee who understood this really well and I would have sessions with him separately [to develop our risk strategy],” Lewis explains.

This in turn made it an easier job to explain why the risk appetite statement was needed. “Trustees get assurance from other trustees in the room saying, ‘this is important, I’ve seen this done at my accounting firm and this is a really solid process’.”

Guiding operations

However, while trustees need to have final oversight of a risk appetite statement, the day-to-day use sits a layer below. “The most important functional audience is the heads of the service or the principles focusing on the areas described within [the document],” Thurogood-Hyde says.

He cites the Technology Infrastructure section of the risk appetite statement as an example.

This is listed as “Minimalist, moving to cautious, aspiring to be innovative” - with an explanation that while the current risk appetite is low, in the future “greater uncertainty will need to be entertained” in order to “yield longer-term benefits”.

By “articulating this direction of travel”, he says, the IT team can better plan ahead by, for example, understanding laptop replacement cycles can remain the same for now, but in the future may require something higher-spec.

Lewis at LIFT adds there can also be sub-areas of risk appetite within different areas, such as for financial management where the core approach is “minimal”, but for some smaller areas is one level up, as “cautious”.

“We’ve agreed to allow a little bit more risk when it comes to income diversification. So we are looking at improving the share of income we get outside of government funding and take a bit more risk there - it will be ring fenced but we are willing to look at it differently.”

These variations can also be applied at a school level, she says: “We’ve gone down to that level of nuance where we say it’s not just ‘education risk is a cautious appetite’ but actually, this set of schools, can experiment a bit more.”

For trusts yet to go through such a process this may sound like a lot of work - especially when a “low risk” approach is an easy stance to articulate to trustees. Indeed, Meeks notes for all the growth in this area, many MATs still have a way to go in this area.

“The less mature organisations we work with, they’re quite good at identifying risks, but it’s the risk appetite that should follow on from that they’re maybe not [doing] and saying to trustees, these are our risks, this is what we’re doing and this is what it means for us as an organisation.”

Yet, Confederation of School Trusts (CST) director of trust governance, Samira Sadeghi, says the Academy Trust Governance Code warns against “being over-cautious and risk averse” as that can itself “be a risk and hinder innovation and progress”.

For example, she notes “fast-moving developments” in technology or the need to “think outside the box in order to retain staff” means innovation - and therefore risk - are a must.

This is the stance articulated by Astrea for staff management: “The trust is willing to innovate in order to be an employer of choice and will take risks to secure this position.”

Don’t sit still

Of course, once you’ve created the document and got buy-in, that does not mean it’s a case of job done. Instead, as risks evolve and change so, too, must any risk appetite statement.

“Risk management should be a living, breathing, evolving concept that doesn’t just get put in a drawer once it’s been agreed at the trust board,” says Meeks. Sadeghi adds: “They must keep them under review as the world around us changes and what is going on in a trust changes.”

Lewis at LIFT says they do this by looking at the statement each year with trustees and deciding if any changes are needed: “We ask, what should be in there, what changes are we going to make to our risk appetite statement, where might we relax and innovative a bit, where might we want to be more cautious.”

Meeks says constant check-ins are key because it ensures trustees understand decisions being made within the context of the trust’s current “resting state”.

“Where things can go wrong is if trustees don’t understand how risky the current state of the organisation is, so they are then at risk of making a decision that puts the trust in an unmanageably risky position,” he adds.

Of course, even if you do all this and follow all the guidance, it doesn’t mean you wont be blind-sided by something. “You can always plan for what you think is feasible but big world events like Covid or a massive cyber security breach show things can change,” says Meeks.

But, it does mean you are ready to adapt and innovate within well-defined parameters that should ensure any bets made have the best chance of paying off.

Sadeghi concludes: “It should never be about being reckless, but being prepared to understand that while trying new things will sometimes go wrong, we can never improve if we never change.”

For key school and trust leadership insights delivered every month, sign up for the Tes Leaders’ Briefing newsletter